# How to Skip Password Recovery Modules in holehe: The Complete Guide

> Easily skip password recovery modules in holehe using the NP flag. Exclude Adobe, Mail.ru, Odnoklassniki, and Samsung checks while keeping standard email verification. Learn how to bypass these modules now.

- Repository: [Palenath/holehe](https://github.com/megadose/holehe)
- Tags: how-to-guide
- Published: 2026-08-22

---

**Use the `-NP` or `--no-password-recovery` command-line flag when running holehe to exclude password-recovery checks from Adobe, mail.ru, Odnoklassniki, and Samsung while retaining standard email verification modules.**

holehe is an open-source OSINT tool by megadose that checks whether an email address is registered on various websites. By default, it includes modules that probe password-recovery endpoints, but you can skip these modules to reduce noise and avoid unnecessary requests. This guide explains exactly how the filtering mechanism works in the source code and how to apply it from both the CLI and programmatically.

## Understanding the `--no-password-recovery` Flag

When you invoke holehe without any flags, it loads every available module—including those that interact with password-recovery endpoints. These specific modules check whether an account exists by attempting to initiate a password reset flow, which some users may wish to avoid for stealth or scope reasons according to the megadose/holehe source code.

The tool provides a built-in toggle to disable this behavior. In [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the argument parser defines the flag at lines 90–92:

```python
parser.add_argument("-NP","--no-password-recovery", default=False,
                    required=False,action="store_true",
                    dest="nopasswordrecovery",
                    help="Do not try password recovery on the websites")

```

Setting this flag to `True` triggers conditional logic that excludes four specific modules from the execution list.

## How the Filtering Works in holehe/core.py

The filtering logic resides in the `get_functions` method within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) (approximately lines 58–62). When `args.nopasswordrecovery` evaluates to `True`, the code explicitly checks the string representation of each module and omits any containing references to specific password-recovery implementations:

```python
if args is not None and args.nopasswordrecovery == True:
    if "adobe" not in str(modu.__dict__[site]) and
       "mail_ru" not in str(modu.__dict__[site]) and
       "odnoklassniki" not in str(modu.__dict__[site]) and
       "samsung" not in str(modu.__dict__[site]):
        websites.append(modu.__dict__[site])
else:
    websites.append(modu.__dict__[site])

```

This hardcoded exclusion list ensures that when you skip password recovery modules in holehe, the tool never imports or executes the target functions from the affected modules, preventing any outbound password-recovery requests.

## Command-Line Usage Examples

You can activate this filter using either the short or long flag format. Both approaches produce identical results.

**Standard execution (includes password recovery):**

```bash
holehe user@example.com

```

**Skip password recovery modules:**

```bash
holehe -NP user@example.com

```

**Alternative long-form syntax:**

```bash
holehe --no-password-recovery user@example.com

```

When the flag is present, holehe suppresses the four password-recovery modules while continuing to check all other sites for email registration status.

## Programmatic Implementation

If you are embedding holehe into a larger Python workflow rather than using the CLI, you can still skip password recovery modules in holehe by manipulating `sys.argv` before importing the core main function:

```python
import sys
sys.argv = ["holehe", "-NP", "user@example.com"]
from holehe.core import main
main()

```

Alternatively, you can inspect exactly which modules remain after filtering by manually invoking the internal parser and `get_functions`:

```python
from holehe.core import import_submodules, get_functions, ArgumentParser

parser = ArgumentParser()
parser.add_argument("-NP", "--no-password-recovery", action="store_true")
args = parser.parse_args(["-NP"])

modules = import_submodules("holehe.modules")
sites = get_functions(modules, args)
print([s.__name__ for s in sites])  # Excludes: adobe, mail_ru, odnoklassniki, samsung

```

## Which Modules Are Excluded?

When the `--no-password-recovery` flag is active, holehe specifically filters out these four modules:

- **[`holehe/modules/software/adobe.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/software/adobe.py)** – Adobe password-recovery endpoint checks
- **[`holehe/modules/mails/mail_ru.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/mails/mail_ru.py)** – Mail.ru password-recovery probes
- **[`holehe/modules/social_media/odnoklassniki.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/social_media/odnoklassniki.py)** – Odnoklassniki password-recovery verification
- **[`holehe/modules/products/samsung.py`](https://github.com/megadose/holehe/blob/main/holehe/modules/products/samsung.py)** – Samsung account password-recovery lookups

These files implement logic that interacts with "forgot password" workflows rather than standard registration checks. All other modules in the `holehe/modules/` directory continue to execute normally.

## Summary

- **Primary method:** Append `-NP` or `--no-password-recovery` to your holehe command to disable password-recovery checks.
- **Implementation location:** The filtering logic lives in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) within the `get_functions` method (lines 58–62).
- **Excluded modules:** Adobe, mail.ru, Odnoklassniki, and Samsung modules are removed from the execution list when the flag is set.
- **Programmatic access:** Set `sys.argv` to include `-NP` before importing `holehe.core.main`, or manually pass parsed arguments to `get_functions`.

## Frequently Asked Questions

### What is the exact difference between using holehe with and without the `-NP` flag?

Without the `-NP` flag, holehe executes all available modules including those that send requests to password-recovery endpoints to verify account existence. With the `-NP` flag active, the tool specifically excludes the Adobe, mail.ru, Odnoklassniki, and Samsung modules, performing only standard email registration checks on remaining sites.

### Can I exclude specific password-recovery modules individually instead of all four?

According to the current implementation in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py), the filtering logic uses a hardcoded string check for the four specific module names. There is no granular CLI option to disable them individually; you must either skip all password recovery modules using `-NP` or modify the source code in [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py) (lines 58–62) to adjust the exclusion criteria.

### Does skipping password recovery modules improve scanning speed?

Removing the four password-recovery modules eliminates network requests to those specific endpoints, which marginally reduces total execution time. However, the primary benefit is operational: you avoid triggering password-reset emails or account lockout mechanisms on the target platforms, making the scan stealthier and less invasive.

### Is the `-NP` flag available in all versions of holehe?

The `--no-password-recovery` functionality is implemented in the current master branch of megadose/holehe within [`holehe/core.py`](https://github.com/megadose/holehe/blob/main/holehe/core.py). If you are using an older release or fork that lacks the argument definition at lines 90–92 and the conditional filter at lines 58–62, the flag will not be recognized and the tool will throw an unrecognized argument error.